Governance in the Data Layer Is a Good Idea. It Is Still a Promise.

Pillar 02 · Legal

Floyd Christofferson at Hammerspace published a piece in HPCwire this month titled “Sovereign AI Without Data Silos.” It is worth reading. Most vendor content on sovereignty is flag-washing with a logo. This one actually makes an argument.

The argument goes like this. AI pipelines span jurisdictions by nature. Training data lands in one country, gets enriched in another, gets processed wherever the GPUs are. The reflex answer is to build a sovereign stack per country and copy the data into each one. That produces shadow copies, reactive governance and a fragmentation problem that looks a lot like the one you were trying to fix. So stop thinking about where the storage box sits. Push the rules into the data itself. Tag a file “EU-Restricted” and let the orchestration layer refuse to place it anywhere outside the EU.

I agree with almost all of that. Residency is a location. Sovereignty is control. Anyone still selling the first as the second should read the piece twice.

Here is where I get off the bus.

The mechanism they describe is a global namespace with a policy engine on top. Metadata drives placement. Placement enforces the rule. The data on those volumes is plaintext, or encrypted with keys the operator of the namespace holds. That is not a criticism of Hammerspace. It is what a file system is. A file system has to read the file.

Now walk the compulsion path. A court, a national security letter, a CLOUD Act request lands on whoever runs that namespace. What can they produce? Everything the namespace can see. Which is everything. The “EU-Restricted” tag is a placement rule. It has no opinion about a subpoena. The admin who can write the objective can also rewrite it. The policy engine is a single point of compulsion with a very nice dashboard.

So the model keeps data in the right jurisdiction. Good. It does nothing about who can be made to hand it over once it is there. And “once it is there” is the whole game. The Microsoft Ireland case was about data sitting in Dublin. Location held. Control didn’t.

The same gap shows up at the AI boundary. The piece is careful about the storage side. Raw citizen data stays in France, derived sets can move within the EU, GPU clusters elsewhere see only approved subsets. Sensible. But “approved subsets” still leave the boundary in the clear to reach the model. The moment a shard of your data is sitting in memory on somebody else’s accelerator, the namespace policy is a memory. Whatever that operator can be compelled to produce, they can produce. The rule stayed home. The data went on a trip.

What would actually close the loop is boring and mathematical. Encrypt client-side before the storage layer ever sees bytes. Split the ciphertext across operators in independent jurisdictions so no single one holds a reconstructable copy. Keep the keys out of every operator’s hands, including yours as the vendor. Then a compelled disclosure returns fragments nobody can read, and the honest answer to the warrant is “we cannot.” Not “we won’t.” Cannot.

That is a custody layer. It sits under the namespace, under the orchestration, under the model. It does not compete with Hammerspace and it does not care which storage vendor is underneath. Keep your hyperscaler. Keep your file system. Change what the file system is allowed to see.

To be fair to Floyd, he ends the article by saying this is only the starting point and that agentic workflows will make distributed governance harder. He is right. Agents don’t respect a namespace boundary any better than a GPU cluster does. When the thing reading your data is a process you didn’t write, running somewhere you didn’t pick, a placement rule is a suggestion.

The industry has spent three years moving the sovereignty conversation from “where is the data centre” to “where is the policy.” That was real progress. The next move is from “where is the policy” to “who can be forced to break it.” Storage vendors will get you to the second question. Only architecture answers the third.

Sovereignty by architecture. Not by promise. Not by metadata either.

Sovereign AI Without Data Silos — HPCwire, 11 September 2026